Analysis

  • max time kernel
    155s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 12:50

General

  • Target

    4eb25c2594fe58820a6ff20a77b9fb2907fd66a7d73ae60df7299a8bb4f6ef53.exe

  • Size

    9.8MB

  • MD5

    3ab9337aac1be0998645264992e20232

  • SHA1

    c4abdaa2d96d159fbdc9f68db31aef47fbc0fd6a

  • SHA256

    4eb25c2594fe58820a6ff20a77b9fb2907fd66a7d73ae60df7299a8bb4f6ef53

  • SHA512

    92dcedaeb4a003f9af06659078ca1143198e4eb0746e3987d1376581d7ffa42d27713079f88078dfb7f6d04c11a2e994e5c874dcd211473abfab7d1e1d1f93a4

  • SSDEEP

    196608:w8PikyOCON0CzbZ0Uqsb4H0gKdCIetOl27hEMSOsx:XPiQXbZ0UcH0gb50oqfOsx

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 36 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 29 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4eb25c2594fe58820a6ff20a77b9fb2907fd66a7d73ae60df7299a8bb4f6ef53.exe
    "C:\Users\Admin\AppData\Local\Temp\4eb25c2594fe58820a6ff20a77b9fb2907fd66a7d73ae60df7299a8bb4f6ef53.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4088
    • C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\System32\PING.EXE" www.baidu.com -n 2
      2⤵
      • Runs ping.exe
      PID:5076
    • C:\Users\Admin\AppData\Roaming\MyMacro\Runner.exe
      --host_id 3 --verify_key rPQ1r_Qwx2zF --product "C:\Users\Admin\AppData\Local\Temp\4eb25c2594fe58820a6ff20a77b9fb2907fd66a7d73ae60df7299a8bb4f6ef53.exe" --runner_md5 Rjg4N0Q0MjY2MkI0RUM3RTU3N0VBOTI0RUVDOEM3ODcA --version 2014.06.19549
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4616
    • C:\Users\Admin\AppData\Roaming\MyMacro\binding.exe
      C:\Users\Admin\AppData\Roaming\MyMacro\binding.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1848
    • C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\System32\PING.EXE" www.baidu.com -n 2
      2⤵
      • Runs ping.exe
      PID:1980
  • C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
    1⤵
      PID:2336
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k UnistackSvcGroup
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1504

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\boost_interprocess_qm\04OIy_qCl4W_

            Filesize

            1.3MB

            MD5

            4322151228ac50c1f08e33f935446fa2

            SHA1

            8ffa8b1bf39e3933ac762a1faca7649144aa16b2

            SHA256

            a9c677a5ecd5a9123a7ce65ba197e8d3153d4f3a18ee1efa10de227628bcaf71

            SHA512

            87e71d10467dec0bfc722448b1af3066c16f5924b606ce6a0313ec2d000d54f476f235d8585150c631f23e70e9dd63232859494bb862325a921f0e32a6ae8650

          • C:\ProgramData\boost_interprocess_qm\OBQ4isfPZID

            Filesize

            258B

            MD5

            0bd974b0292ed202870c835b7bdae23d

            SHA1

            91b4a1a035be83bf7bf0393d3f99f50bed1c52ce

            SHA256

            33628d93a6adab3af042906a3cb52d4d36b0ccaa37627b2b0c3969694eb82b0c

            SHA512

            57ebdbe8160b20c53d6bb862c1ea0035d7896fce2a57132a8bf6203b5781f4dcc7ee1a72f6b5a69541547461fbab4df1a933845ff5bf1b2920bcb84101e09e1f

          • C:\ProgramData\boost_interprocess_qm\OBQ4isfPZIDj

            Filesize

            256KB

            MD5

            077ae08ad5c88f958bf01674c266d0ee

            SHA1

            75f7da3d141e24219d6e9de033f97bac038fdbf1

            SHA256

            67a5c5d79a95d40c16543a2a11ce69b189f4673248f16ec9f0ed521e37aaf61d

            SHA512

            586cba752703290cd40a06fbd7e0897b2008e6eb2b712710720262c9c95c23dea617288fdbd8ccf4b884477ad1823e6255106e0558ad647bf69dc6dd851b5985

          • C:\ProgramData\boost_interprocess_qm\VbxJdh95lcxC

            Filesize

            256KB

            MD5

            7b213b731a47c1d523a9360ece93bdab

            SHA1

            179f49ce2c868a3c3ee94d9fdda373310705275d

            SHA256

            11fc518f8bf2bc494299d18d57d3949f296efeb066c9e14a46b6ff88254320ee

            SHA512

            f4a6b3587be275731c09b07b146cb303b94acc6d7e67c95b38176cf702fc0f51165e542dcd3bcec52696551678fcfa5d46bd8fcc05c37c285937281a147b9a20

          • C:\Users\Admin\AppData\Local\Temp\QMLog\20231012.log

            Filesize

            324B

            MD5

            8eb6739a90f91735837a5a46f6ed3251

            SHA1

            3607eb8cea0b3ff49948f49a6cd71049a3758a16

            SHA256

            10a17df83bfdc2dc1eb8babea592e9961564243ef2773afa671c1cc7e461301a

            SHA512

            af93d849a5b7a89b2a887364a61ecd8a58b31f1db993dadcc7198bd09fca6f25abc352e59fe4756164c634c028e451c116c2f78933c028bc109341d3dc6bc9d5

          • C:\Users\Admin\AppData\Local\Temp\ad-mymacro9.xml.tmp

            Filesize

            3KB

            MD5

            6a004b4196400a627b5b6248a2a2dcba

            SHA1

            fa9a555e83a4c3a73e07a728ec92827f55fbcf02

            SHA256

            9cd3e3f97866082f8edfed25d56b40786c2809f264c4f8b10c022403e7f0f101

            SHA512

            1b5cea41dce0742e4ba7a7f3c4bef3eefc92c63d267a306e4098c68b768723abc0f0eace4a486ff3f4b1bb8a74279dd04e9c2a48df9a20125c21209e3d205624

          • C:\Users\Admin\AppData\Local\Temp\mac85AB.tmp

            Filesize

            1KB

            MD5

            df05ed3bf992928e7d0d5af1dbd2cde5

            SHA1

            24bec6bf99abd879d430299c1ee84951331bdf05

            SHA256

            6882ad82680ff02237980d102bb871b7f3ddce92b1e322a2777657fb17343817

            SHA512

            dd9e8f0dc42ebd983761ec787c269cb523e24d781515e3aaa8acfee42a00d8f416b8728d463cd7b6fff2f76d3c67e70d1b51287dee530a43cb2ef9b3687bacd3

          • C:\Users\Admin\AppData\Roaming\MyMacro\Runner.exe

            Filesize

            7.2MB

            MD5

            6293dc8adef748b02fb614733007ecd6

            SHA1

            105ee791a7f1a9034d70db76a4fe3765a761f526

            SHA256

            862e7f2a5d41423d31336f87fb405ed04768c92b948270cf7d0bf9c8892a2f79

            SHA512

            7b7d71cadd18b7ecfb70f04629d91637337236f6500b52d7c095c2b97a3380aefb3815c8804a67162c0a2452b0606d7ab27b04270d1c589afe39bda4993f6943

          • C:\Users\Admin\AppData\Roaming\MyMacro\Runner.exe

            Filesize

            7.2MB

            MD5

            6293dc8adef748b02fb614733007ecd6

            SHA1

            105ee791a7f1a9034d70db76a4fe3765a761f526

            SHA256

            862e7f2a5d41423d31336f87fb405ed04768c92b948270cf7d0bf9c8892a2f79

            SHA512

            7b7d71cadd18b7ecfb70f04629d91637337236f6500b52d7c095c2b97a3380aefb3815c8804a67162c0a2452b0606d7ab27b04270d1c589afe39bda4993f6943

          • C:\Users\Admin\AppData\Roaming\MyMacro\Runner.exe

            Filesize

            7.2MB

            MD5

            6293dc8adef748b02fb614733007ecd6

            SHA1

            105ee791a7f1a9034d70db76a4fe3765a761f526

            SHA256

            862e7f2a5d41423d31336f87fb405ed04768c92b948270cf7d0bf9c8892a2f79

            SHA512

            7b7d71cadd18b7ecfb70f04629d91637337236f6500b52d7c095c2b97a3380aefb3815c8804a67162c0a2452b0606d7ab27b04270d1c589afe39bda4993f6943

          • C:\Users\Admin\AppData\Roaming\MyMacro\binding.exe

            Filesize

            1.7MB

            MD5

            6abd36f782e36bcf9e90a3230d6ca97f

            SHA1

            3c3d5760a8db6c66f4c5b8c31cbf2613a8a7d6b9

            SHA256

            13652dae4ec58de8a20da51c7455f34144554b91d25ac1c72bec9cbe361ca752

            SHA512

            05463e3c0028e8e39787465e4529ad22c9c64c2a29701c4673f983b50852573aa3c197c2307fdf58d9ab514cca06f058cc17a8b53d28e76957792be7ac1acce6

          • C:\Users\Admin\AppData\Roaming\MyMacro\binding.exe

            Filesize

            1.7MB

            MD5

            6abd36f782e36bcf9e90a3230d6ca97f

            SHA1

            3c3d5760a8db6c66f4c5b8c31cbf2613a8a7d6b9

            SHA256

            13652dae4ec58de8a20da51c7455f34144554b91d25ac1c72bec9cbe361ca752

            SHA512

            05463e3c0028e8e39787465e4529ad22c9c64c2a29701c4673f983b50852573aa3c197c2307fdf58d9ab514cca06f058cc17a8b53d28e76957792be7ac1acce6

          • C:\Users\Admin\AppData\Roaming\MyMacro\cfgdll.dll

            Filesize

            64KB

            MD5

            e54b7e3ba6c2fd0d79f90e6ba3c019de

            SHA1

            bce9232085090de1b24f017730b7eaf4e7bff68c

            SHA256

            a553d8637dbe0645743eb5f76adf40678cf2fa1e01754f70191e729b7625949c

            SHA512

            fe7777147afea2e90cffa6ba44d7bd81ef036cd3dd6f771a1929811039b7ca4054be598bd5b4df704b5724bb654b1135d53cc617355ff2d3d70708560f549b75

          • C:\Users\Admin\AppData\Roaming\MyMacro\qdisp.dll

            Filesize

            317KB

            MD5

            0c6fe138b1ea6a26dead585b6128bdab

            SHA1

            20d3f819698b12f36fd1f3e63bcd5621b574fd47

            SHA256

            372085c07df86bbd6b7588f1859b7fab8440a3ccedf643067779b6b9c6a67d93

            SHA512

            7d494cbaac76bfb8160088adf9fb6f3313ee56d3bb0db9e5c330c185246818d9ef67e45ee5877842572a50145810fe0748eaeb56c2359859dc8f30b80880b0d8

          • C:\Users\Admin\AppData\Roaming\MyMacro\qdisp.dll

            Filesize

            317KB

            MD5

            0c6fe138b1ea6a26dead585b6128bdab

            SHA1

            20d3f819698b12f36fd1f3e63bcd5621b574fd47

            SHA256

            372085c07df86bbd6b7588f1859b7fab8440a3ccedf643067779b6b9c6a67d93

            SHA512

            7d494cbaac76bfb8160088adf9fb6f3313ee56d3bb0db9e5c330c185246818d9ef67e45ee5877842572a50145810fe0748eaeb56c2359859dc8f30b80880b0d8

          • C:\Users\Admin\AppData\Roaming\MyMacro\qdisp.dll

            Filesize

            317KB

            MD5

            0c6fe138b1ea6a26dead585b6128bdab

            SHA1

            20d3f819698b12f36fd1f3e63bcd5621b574fd47

            SHA256

            372085c07df86bbd6b7588f1859b7fab8440a3ccedf643067779b6b9c6a67d93

            SHA512

            7d494cbaac76bfb8160088adf9fb6f3313ee56d3bb0db9e5c330c185246818d9ef67e45ee5877842572a50145810fe0748eaeb56c2359859dc8f30b80880b0d8

          • memory/1504-177-0x0000023FAA310000-0x0000023FAA311000-memory.dmp

            Filesize

            4KB

          • memory/1504-140-0x0000023FA1E70000-0x0000023FA1E80000-memory.dmp

            Filesize

            64KB

          • memory/1504-156-0x0000023FA1F70000-0x0000023FA1F80000-memory.dmp

            Filesize

            64KB

          • memory/1504-176-0x0000023FAA300000-0x0000023FAA301000-memory.dmp

            Filesize

            4KB

          • memory/1504-173-0x0000023FAA2E0000-0x0000023FAA2E1000-memory.dmp

            Filesize

            4KB

          • memory/1504-175-0x0000023FAA300000-0x0000023FAA301000-memory.dmp

            Filesize

            4KB

          • memory/4088-61-0x0000000000AD0000-0x0000000001218000-memory.dmp

            Filesize

            7.3MB

          • memory/4088-139-0x0000000000AD0000-0x0000000001218000-memory.dmp

            Filesize

            7.3MB

          • memory/4088-7-0x0000000000AD0000-0x0000000001218000-memory.dmp

            Filesize

            7.3MB

          • memory/4088-66-0x0000000000AD0000-0x0000000001218000-memory.dmp

            Filesize

            7.3MB

          • memory/4088-131-0x0000000000AD0000-0x0000000001218000-memory.dmp

            Filesize

            7.3MB

          • memory/4088-118-0x0000000000AD0000-0x0000000001218000-memory.dmp

            Filesize

            7.3MB

          • memory/4088-0-0x0000000000AD0000-0x0000000001218000-memory.dmp

            Filesize

            7.3MB

          • memory/4088-71-0x0000000000AD0000-0x0000000001218000-memory.dmp

            Filesize

            7.3MB

          • memory/4088-121-0x0000000000AD0000-0x0000000001218000-memory.dmp

            Filesize

            7.3MB

          • memory/4088-60-0x0000000000AD0000-0x0000000001218000-memory.dmp

            Filesize

            7.3MB

          • memory/4088-123-0x0000000000AD0000-0x0000000001218000-memory.dmp

            Filesize

            7.3MB

          • memory/4088-137-0x0000000000AD0000-0x0000000001218000-memory.dmp

            Filesize

            7.3MB

          • memory/4088-125-0x0000000000AD0000-0x0000000001218000-memory.dmp

            Filesize

            7.3MB

          • memory/4088-135-0x0000000000AD0000-0x0000000001218000-memory.dmp

            Filesize

            7.3MB

          • memory/4088-127-0x0000000000AD0000-0x0000000001218000-memory.dmp

            Filesize

            7.3MB

          • memory/4088-133-0x0000000000AD0000-0x0000000001218000-memory.dmp

            Filesize

            7.3MB

          • memory/4088-129-0x0000000000AD0000-0x0000000001218000-memory.dmp

            Filesize

            7.3MB

          • memory/4616-119-0x0000000000400000-0x0000000000B3E000-memory.dmp

            Filesize

            7.2MB

          • memory/4616-130-0x0000000000400000-0x0000000000B3E000-memory.dmp

            Filesize

            7.2MB

          • memory/4616-132-0x0000000000400000-0x0000000000B3E000-memory.dmp

            Filesize

            7.2MB

          • memory/4616-128-0x0000000000400000-0x0000000000B3E000-memory.dmp

            Filesize

            7.2MB

          • memory/4616-134-0x0000000000400000-0x0000000000B3E000-memory.dmp

            Filesize

            7.2MB

          • memory/4616-126-0x0000000000400000-0x0000000000B3E000-memory.dmp

            Filesize

            7.2MB

          • memory/4616-136-0x0000000000400000-0x0000000000B3E000-memory.dmp

            Filesize

            7.2MB

          • memory/4616-124-0x0000000000400000-0x0000000000B3E000-memory.dmp

            Filesize

            7.2MB

          • memory/4616-138-0x0000000000400000-0x0000000000B3E000-memory.dmp

            Filesize

            7.2MB

          • memory/4616-122-0x0000000000400000-0x0000000000B3E000-memory.dmp

            Filesize

            7.2MB

          • memory/4616-120-0x0000000000400000-0x0000000000B3E000-memory.dmp

            Filesize

            7.2MB

          • memory/4616-112-0x0000000000400000-0x0000000000B3E000-memory.dmp

            Filesize

            7.2MB

          • memory/4616-172-0x0000000000400000-0x0000000000B3E000-memory.dmp

            Filesize

            7.2MB

          • memory/4616-111-0x0000000000400000-0x0000000000B3E000-memory.dmp

            Filesize

            7.2MB

          • memory/4616-76-0x0000000000400000-0x0000000000B3E000-memory.dmp

            Filesize

            7.2MB

          • memory/4616-67-0x0000000000400000-0x0000000000B3E000-memory.dmp

            Filesize

            7.2MB

          • memory/4616-59-0x0000000000400000-0x0000000000B3E000-memory.dmp

            Filesize

            7.2MB